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DETAILED ACTION 
Claim Rejections - 35 USC § 112 

1. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming 
the subject matter which the applicant regards as his invention. 

2. Claims 1-8, 1 1 and 14 are rejected under 35 U.S.C. 1 12, second paragraph, as being indefinite for failing to 
particularly point out and distinctly claim the subject matter which applicant regards as the invention. 

a. With regard to claim 1 (and thus its dependent claims 2-8): 

i The purpose for which the files, which require to be scanned, is identified is not clear. Notice the 
identification of sucrris not being used. This problem result a missing a necessary step that link the 
identifying step to the rest of the other steps recited in the claim. 

ii Who or what element that does the initiating step is not clear. 

b. With regard to claim 1 1 : 

i The phrase "the first node" at the end of this claim 1 1 lacks antecedent basis. 

(1) Perhaps the phrase <c the first node" at the end of this claim 1 1 should be changed to -the second 
computer-. 

ii With an assumption that the phrase "the first node" at the end of this claim 11 is the first computer, the 
phrase "causing a first computer ... to ... receive the ... portions ... from first computer" is confusing. 

c. With regard to claim 14: 

i The phrase "the workstation corresponding to the second node is arranged to communicate with a 
plurality of workstations corresponding to respective second nodes" is confusing. Perhaps the phrase 
"respective second nodes" is in error. 



Claim Rejections - 35 USC§ 103 



3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness rejections set 
forth in this Office action: 

.(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 102 of this title, if the differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

4. Claim 1-6 and 9-1 1 are rejected under 35 U.S.C. 103(a) as being obvious over Applicant's admitted prior 
art teaches [Applicant's Background of the Invention, paragraphs 2 and 3] in view of Cozza (5,649,095) . 



d. With respect to claim 1 : 

i Claim 1 claims a method 

( 1 ) of scanning electronic files for computer viruses, 

(2) the method comprising: 
(a) identifying 

(i) at a first node 

1 ) of a computer network, 
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(ii) electronic files 

1) which require to be scanned 
a) for computer viruses; 

(b) initiating 

(i) a dialogue 

1) between 

a) said first node and 

b) a second node 

i) of the network, 

ii) the second node comprising 

{ 1 } a virus scanning application, 

2) during which dialogue 
a) the second node 

i) identifies 

{ 1 } to the first node 
{2} one or more portions 
{a} of the electronic file 

{b} required by the virus scanning application; and 

(c) transferring 

(i) the identified portion(s) 

(ii) from the first node 

(iii) to the second node 

(iv) over the network. 

ii Applicant's admitted prior art teaches [see Applicant's Background of the Invention, paragraph 3]: 

( 1 ) One network approach 

(a) embodied in the F-Secure Anti- Virus Agent and Server.TM. product (Data Fellows Oyj, 
Espoo, Finland) 

(b) offers 

(i) an improved solution in which 
1) "agents" 

a) are located at various transit nodes 
i) of a network and 

b) identify 

i) (by for example examining file name extensions) 

ii) data which is capable of containing a computer virus. 

(2) The intercepted suspect data 
(a) is then transferred 

(i) by the agent, 

(ii) over the network, 

(iii) to a central server 
1) comprising 

a) an anti-virus scanning application 

i) which performs a virus scan on the data. 

(3) The result of the virus scan 
(a) is returned 

(i) from the central server 

(ii) to the agent 

1) which initiated the scan. 

(4) The advantage 

(a) of this approach as compared to conventional gateway scanning 

(b) is that 

(i) it is only necessary 
1) to provide 

a) one or a small number of scanning applications in a network. 

iii However, applicant's admitted prior art does not teach: 
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(1) that the second node [i.e., central server] identifies to the first node one or more portions of the 
electronic file required by the virus scanning application, 

(2) since the applicant has said that admitted prior art has disadvantage in that it may require the 
transfer of relatively large volumes of data over a computer network. This can slow down the virus 
scanning operation and may also result in network traffic congestion, having a knock-on effect on 
non-virus scanning related traffic. The transfer of insecure information over a network may also 
introduce security risks. 

iv Cozza (5,649,095) teaches [e.g., in his Abstract, Brief Summary Text -TSTX (18)] 

(1) a method and apparatus for scanning for a computer virus which eliminates the necessity of 
scanning all portions of all files. 

v It would have been obvious to a person having ordinary skill in the art at the time the invention was 
made to: 

(1) apply Cozza's concept of not scanning all portions of file 

(a) to select 

(i) a certain portion(s) 
1) of the file 

a) intercepted by Applicant's admitted prior art 

(ii) for scanning; and 

(b) have the scanner of applicant's admitted prior art accesses only those certain portion(s) for 
scanning. 

vi The skilled person would have been motivated to do such application because: 

(1) Applicant's admitted prior art teaches a scanning file for computer virus and 

(2) Cozza teaches 

(a) the elimination 

(i) of the necessity of scanning all portions of file 

(ii) increases the speed at which a file can scan for the presence of a virus — [col. 1, lines 15- 
21]. 

e. With respect to claim 2: 

i Claim 2 claims: 

(1) 2. A method according to claim 1 and comprising 

(a) identifying 

(i) electronic files which require virus scanning, 

(ii) at a plurality of first nodes of the computer network and 

(b) initiating a dialogue between the first nodes and the said second node when appropriate. 

ii Applicant's admitted prior art teaches: 
( 1 ) One network approach 

(a) embodied in the F-Secure Anti- Virus Agent and Server.TM. product (Data Fellows Oyj, 
Espoo, Finland) 

(b) offers 

(i) an unproved solution in which 
1) "agents" 

a) are located at various transit nodes 
i) of a network and 

b) identify 

i) (by for example examining file name extensions) 

ii) data which is capable of containing a computer virus. 

f. With respect to claim 3 : 

i Claim 3 claims: 

(1) 3. A method according to claim 1, wherein the first node and the second node are located at 
respective different locations in the computer network. 

ii Applicant's admitted prior art teaches: 
( 1 ) One network approach 
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(a) embodied in the F-Secure Anti- Virus Agent and Server.TM. product (Data Fellows Oyj, 
Espoo, Finland) 

(b) offers 

(i) an improved solution in which 
1) "agents" 

a) are located at various transit nodes 
i) of a network and 

b) identify 

i) (by for example examining file name extensions) 

ii) data which is capable of containing a computer virus. 

(2) The intercepted suspect data 
(a) is then transferred 

(i) by the agent, 

(ii) over the network, 

(iii) to a central server 
1) comprising 

a) an anti-virus scanning application 

i) which performs a virus scan on the data. 
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g. With respect to claim 4: 

i Claim 4 claims: 

(1) 4. A method according to claim 1, wherein the first node is one of: 

(a) a database server, 

(b) electronic mail server, 

(c) an Internet server, 

(d) a proxy server, or 

(e) a firewall server. 

ii Applicant's admitted prior art teaches [see Applicant's Background of the Invention, paragraph 2]: 

(1) that a gateway based anti- virus application is typically provided at 

(a) a firewall (being transit node of a network) 

(b) Internet server (being transit node of a network), 

(c) mail server (being transit node of a network); and 

(2) that the centralized scanning embodied in the F-Secure Anti- Virus Agent and Server.TM. product 
(Data Fellows Oyj, Espoo, Finland) 

(a) offers: 

(i) "agents" 

1) are located at various transit nodes 
a) of a network and 

2) identify 

a) (by for example examining file name extensions) 

b) data which is capable of containing a computer virus. 

(b) The intercepted suspect data 
(i) is then transferred 

1) by the agent, 

2) over the network, 

3) to a central server 
a) comprising 

i) an anti- virus scanning application which performs a virus scan on the data. 



h. With respect to claim 5 : 

i Claim 5 claims: 

(1) 5. A method according to claim 1, wherein the dialogue is carried out using a network protocol 
carried by IP. 

ii It would have been obvious to a person having ordinary skill in the art at the time the invention was 
made to: 

(1) realize that the communication (in applicant's admitted prior) between the transit nodes and the 
central server is done by using a network protocol carried by IP (and if not substitute one therefor). 



i. With respect to claim 6: 
i Claim 6 claims: 

(1) 6. A method according to claim 1 and comprising 

(a) analyzing 

(i) the file portions 

1) received at the second node 

(ii) to determine 

1) whether or not the file contains a virus or 

2) cannot be guaranteed to not contain a virus, and 

(b) returning 

(i) the result 
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(ii) to the first node 

(iii) over the network. 



ii Applicant's admitted prior art teaches [see Applicant's Background of the Invention, paragraph 3]: 

( 1 ) One network approach 

(a) embodied in the F-Secure Anti- Virus Agent and Server.TM. product (Data Fellows Oyj, 
Espoo, Finland) 

(b) offers 

(i) an improved solution in which 
1) "agents" 

a) are located at various transit nodes 
i) of a network and 

b) identify 

i) (by for example examining file name extensions) 

ii) data which is capable of containing a computer virus. 

(2) The intercepted suspect data 
(a) is then transferred 

(i) by the agent, 

(ii) over the network, 

(iii) to a central server 
1) comprising 

a) an anti-virus scanning application 

i) which performs a virus scan on the data. 

(3) The result of the virus scan 
(a) is returned 

(i) from the central server 

(ii) to the agent 

1) in the transit node 

2) which initiated the scan. 



j . With respect to claim 9 : 
i Claim 9 claims: 

(1) 9 An anti- virus scanning system 

(a) for use in scanning 
(i) electronic files 

1 ) in a computer network, 

(b) the system comprising: 

(i) a first computer having 
1) processing means 

a) arranged to identify electronic files which should be scanned for computer 
viruses; and 

(ii) a second computer having 
1 ) processing means 

a) arranged to perform a virus scanning operation, 

(2) the first computer 

(a) further comprising communication means 

(b) for initiating a dialogue 

(i) between the first computer and the second computer, 

(ii) during which 

1) the second computer 

a) identifies 

b) to the first computer 

c) those portions of the electronic files required 
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i) by the first computer 

ii) for performing the virus scanning operation, and 
(c) for transferring 

(i) those portions 

(ii) to the second computer, 
ii As to claim 9: 

( 1 ) Claim 9 has limitations that are similar to the of claim 1 , 

(a) which limitations of claim 1 have been addressed above in the section rejection claim 1 with 
reference to Applicant's admitted prior art and Cozza 

(2) The steps of claim 1 are carried out by the component of claim 9, and the elements of claim 9 
carry out the steps of claim 1. 

(3) Claim 9 is thus rejected with the same rationales applied against claim 1 . 



k. With respect to claim 10: 

i Claim 10 claims: 

( 1 ) 1 0. A computer memory 

(a) encoded with executable instructions 

(b) representing a computer program 

(c) for causing 

(i) a first computer connected to a computer network to: 

1) identify electronic files which require to be scanned for computer viruses; 

2) initiate 

a) a dialogue 

i) between the first computer and a second computer also connected to the 
computer network; 

3) receive 

a) from the second computer 

b) an identification of portions of the electronic file 

i) which are required for virus scanning of the electronic files at the second 
computer; and 

4) transfer 

a) the identified portion 

i) from the first computer 

ii) to the second computer. 

ii As to claim 10: 

( 1 ) Claim 1 0 has limitation that are similar to those of claim 1 , 

(a) which limitation as been address above in the section rejecting claim 1 with reference to 
Applicant's admitted prior art and Cozza. 

(2) It is understood that the first computer of Applicant's admitted prior art carries out its method 
steps according to executable instructions that have been encoded into a computer memory. 

(3) Claim 10 is thus rejected with the same rationales applied against claiml. 

1. With respect to claim 1 1 : 
i Claim 1 1 claims: 

( 1 ) 1 1 . A computer memory 

(a) encoded with executable instructions 

(b) representing a computer program 

(c) for causing 

(i) a first computer connected to a computer network to: 
1) receive 

a) a dialogue initiation request 

i) from a second computer also connected to the computer network 
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ii) concerning an electronic file identified by the second computer as requiring 
a virus scan; 

2) identify 

a) to the second computer 

b) those portions 

i) of the electronic file 

ii) which are required by the first mentioned computer 

iii) for performing a virus scanning operation at the first computer; and 

3) receive 

a) the identified portions 

i) of the electronic file 

ii) from the first node. 

ii As to claim 1 1 : 

(1) Claim 1 1 has limitation that are similar to those of claim 1, 

(a) which limitation as been address above in the section rejecting claim 1 with reference to 
Applicant's admitted prior art and Cozza. 

(b) It appears that: 

(i) the first computer recited in claim 1 1 is the second node recited in claim 1 ; 

(ii) the second computer recited in claim 1 1 is the first node recited in claim 1 . 

(2) It is understood that the first computer (and the second) of Applicant's admitted prior art carries 
out its method steps according to (their respective) executable instructions (assigned for them and) 
which have been encoded into a computer memory (associated with each of them). 

(3) Claim 1 1 is thus rejected with the same rationales applied against claim 1 . 

5. Claim 7, 8 and 12-14 are rejected under 35 U.S.C. 103(a) as being unpatentable over Applicant's admitted 
prior art and Cozza as applied to claim 1 above, and further in view of common practice in the art. 



m. With respect to claim 7: 
i Claim 7 claims: 

(1) 7 A method according to claim 6 and comprising 
(a) transferring 

(i) from the second node 

(ii) to the first node 

(iii) data portions to be written into the file to disinfect the file, 
to claim 7: 

Official notice is hereby taken that: 

(a) it is a common practice in the art of disinfecting computer virus to discard an unwanted file 
by either: 

(i) erase/delete it or 

(ii) overwrite the data therein with certain data. 
It would have been obvious to a person having ordinary skill in the art at the time the invention 
was made to: 

(a) send a certain piece of data into an unwanted file of and 

(b) write that piece over the unwanted data in the files 

The skilled person would have been motivated to do such overwriting because it is a common 
practice in die art. 



ii As 
(1) 

(2) 
(3) 



n. 



With respect to claim 8: 
i Claim 8 claims: 
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(1) 8 A method according to claim 6 and comprising 
(a) sending 

(i) instructions 

1 ) from the second node 

2) to the first node 

(ii) to inform the first node how to disinfect the file. 



ii As to claim 7: 

(1) Official notice is hereby taken that: 

(a) it is a common practice in the art of disinfecting computer virus to 

(i) provide instructions (computer virus disinfecting module) to a computer so as to execute 
therein to discard an unwanted file by either: 

1) erase/delete it or 

2) overwrite the data therein with certain data. 

(2) It would have been obvious to a person having ordinary skill in the art at the time the invention 
was made to: 

(a) provide instruction codes for a computer, which is disinfect computer virus, for causing it to: 

(i) erase/delete or 

(ii) write that piece over the unwanted data in the files (such as all 0's or all 1 's). 

(3) The skilled person would have been motivated to provide such provision do such 
deleting/overwriting because it is a common practice in the art. 

o. With respect to claim 12: 

i Claim 12 claims: 

(1) 12 A method 

(a) of disinfecting 

(i) an electronic file 

1) stored at a first node of a computer network, 

(ii) after the file has been identified as containing a virus by a virus scanning engine located 
at a second network node, 

(2) the method comprising: 

(a) sending 

(i) from the second node 

(ii) to the first node, 

(iii) data portions to be written into the infected file and/or 

(iv) instructions for disinfecting the file; and 

(b) receiving 

1) the data portions and/or instructions 

2) at the first node and 

(ii) writing 

1) the data portions 

2) into the infected file and/or 

(iii) carrying out said instructions. 

ii As to claim 12: 

(1) Claim 12 has limitations that are similar to those of claim 7 and 8. 
(a) The steps, 

(i) which are carried out for disinfecting an electronic file stored at a first node of a 
computer network, after the file has been identified as containing a virus by a virus 
scanning engine located at a second network node, 

(ii) have been 

1) presented in claims 7 and 8, and 

2) addressed above in the section rejecting claims 7 and 8 with respect to Applicant's 
admitted prior art and Cozza. 

(2) Claim 12 is thus rejected with the same rationales applied against claims 7 and 8. 



Application/Control Number: 09741,084 
Art Unit: 2135 



Page 11 



p. With respect to claim 13: 

i Claim 13 claims: 

(1 ) 13 A method according to claim 12, wherein 

(a) said first and second nodes 

(b) are respective computer workstations coupled to a common network. 

ii As to claim 13: 

(1 ) Claim 13 has limitations that are similar to those of claim 3, 

(a) which limitations of claim 3 have been addressed above in the section rejecting claim 3 with 
respect to Applicant's admitted prior art and Cozza. 

(2) Claim 13 is thus rejected with the same rationale applied against claim 3. 

q. With respect to claim 14: 
i Claim 14 claims: 

(1) 14. A method according to claim 13, wherein 
(a) the workstation 

1) corresponding to the second node 
(ii) is arranged to communicate 

1 ) with a plurality of workstations 

a) corresponding to respective second nodes. 

(2) As to claim 14: 

(a) Claim 14 is interpreted as being corresponding to claim 2 (except for the error pointed out in 
the above rejection of this claim 14 under 35 USC 1 12, second paragraph). 

(b) Claim 14 has limitation that is similar to that of claim 2, 

(i) which limitation of claim 2 has been addressed above in the section rejection claim 2 
with reference to Applicant's admitted prior art and Cozza. 

(c) Claim 14 is thus rejected with the same rationale applied against claim 2. 
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1. 
2. 



The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. 

Any inquiry concerning this communication or earlier communications from the examiner should be directed to 
Ly V. Hua whose telephone number is (703) 305-9684. The examiner can normally be reached on Monday to 
Friday from 9:00 AM to 5:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Vu Kim, can be 
reached on 703-305-4303. The fax phone number for the organization where this application or proceeding is 
assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent Application Information 
Retrieval (PAIR) system. Status information for published applications may be obtained from either Private 
PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 




Ly V.Hua 
Primary Examiner 
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